Home/ Questions/Q 9145613
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-17T10:33:28+00:00

I have a great idea for a windows store app. I’d like to make

  • 0

I have a great idea for a windows store app. I’d like to make this app. However it requires a large and valuable database that I will need to create a service for so that people cannot easily steal it.
My thinking is maybe host a mobile service on Azure (which I’ve never tried) and create a .net Web API project to take requests and dish out Json like candy to a windows 8 mvvmclient. However what I don’t want is someone sniffing my traffic back and forth from app to service and figuring out how to get/post data from using my app and service then setting up their own app / website to display this data using my bandwidth to make them money.

How can I protect my app-to-db data access so it can’t be reverse engineered on me.

Also is this the best setup for developing a high volume windows 8 app like this? Do you have a better suggestion?

I know I can use SSL etc to encrypt traffic to and from. What I am trying to protect is someone using Firebug or Fiddler to figure out what parameters can be posted to get a particular record back. Then creating their own site that simply uses my service as the end point and siphons my data and whores my bandwidth. ie. Just using firebug I know I can use https://www.google.com/search?q=dallas to search the word dallas on google. Even if I encrypt the page, they can see that much in their browser. so if someone does the same get/post in their own application they would get the same records back thus using my stuff.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    The most straight forward thing you can do is to setup authentication for your users using something like OAuth. This will allow you to ensure no communication happens with your service in an anonymous fashion.

    Once you have authenticated your requests you can place controls on those requests that won’t impact a normal user. You could rate limit or throttle requests or any number of tactics to make it very expensive time wise to siphon off large portions of your data set.

    For instance, you can start blocking requests when you notice a large number of users clustering from a single IP address. You could place sensible limits on each user (like 10 API calls per minute with a result set limited to 50). You get the idea I’m sure.

    • 0